SecretCarousel
About
The agent-first secret vault. Coding agents store, rotate, and share secrets — AES-256-GCM encrypted, audited, autonomous.
Details
- Author
- Tyga.Cloud Ltd
- Downloads
- 286
- Categories
- Developer Tools, AI
Jump to
- Claim tokens — hand a secret to another agent/tenant via a one-time, scoped, expiring, audited token
- Rotation — rotate now or on a schedule, with email alerts
- Sharing — time- and view-limited links for humans
- Environments — export as .env, promote secrets between environments
- Scoped API keys — read/write/admin per key, project-scoped
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
SecretCarouselCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
The README includes setup instructions such as npx secretcarousel signup my-project --local.
sc_mint_claim_token
THE agent-to-agent handoff. Mint a ONE-TIME, scoped, expiring claim token that hands a secret to another tenant/agent — even a different project or company. The receiving agent redeems it exactly once, the token burns, and the whole exchange is audit-logged. No plain-text value ever crosses the boundary. Requires a paid plan.
sc_claim_token
Redeem a claim token you were handed by another agent. One-time use — the token burns on redemption and the access is logged. Returns the secret id and name; retrieve the value with sc_get_secret.
sc_list_claim_tokens
List claim tokens you have minted, with their status (pending, claimed, expired) and target tenant.
sc_store_secret
Store a secret encrypted (AES-256-GCM). Returns an ID only — the value is NOT echoed. Reference the secret by id from now on; never write the plain-text value into code, logs, or chat.
sc_get_secret
Retrieve a secret by ID (decrypted). The read is access-logged. Fetch the value only at the moment of use so it never lingers in the transcript.
sc_list_secrets
List secrets (ids + names + metadata, NO values). Filter by type or environment.
sc_search_secrets
Search secret names, descriptions, tags, and categories. Returns ids + names, NO values.
sc_update_secret
Update a secret's value and/or description by ID. The rotation is audit-logged.
sc_delete_secret
Permanently delete a secret by ID. Audit-logged.
sc_rotate_secret
Rotate a secret now (generate a fresh value). Gives a leaked key a short half-life. Audit-logged.
sc_set_rotation_policy
Set a scheduled rotation policy on a secret (e.g. every 30d) with an optional pre-expiry alert.
sc_share_secret
Create a time-limited, view-limited share link for a secret (e.g. hand to a human). Optional password protection. Prefer sc_mint_claim_token for agent-to-agent handoff. Returns a ready-to-use `redeem` block — give the recipient redeem.url and tell them to POST it (no auth). Do NOT hand-build the URL from the raw token: the redeem path is POST /api/v1/shares/access/{token} (POST-only, and the /api/v1 prefix is required — GET or a shorter path 404s).
sc_list_shares
List active share links with their expiry and remaining views. Set includeRevoked=true to also return revoked shares (otherwise they are hidden) — useful as an audit trail of what was un-shared.
sc_show_share
Show one share link's live status and usage counters — status (active/revoked/expired/exhausted), currentUses/maxUses, remainingUses, and revokedAt/reason if revoked. Use this to answer the key incident question: has this share been read yet? (currentUses:0 means the secret was never retrieved.)
sc_revoke_share
Break-glass un-share: immediately revoke an active share link. After revocation the redeem URL returns 410 Gone (code SHARE_NO_LONGER_AVAILABLE) and the secret can no longer be retrieved through that link. This is the emergency path — use it the moment a shared credential needs to be killed. Optional reason is recorded for the audit trail.
sc_audit_log
Read the audit trail — every secret read/write, rotation, share, and claim is logged. Filter by action or resource type.
sc_file_feedback
Report a bug or request a feature for SecretCarousel itself. Use this whenever the product misbehaves, a command is confusing, or something is missing — the report lands on the SecretCarousel team board. Available on every plan (including trial). Set type="bug" for defects (severity P0-P3) or type="feature" for requests (priority P0-P3).
sc_list_feedback
List the bugs and feature requests you have filed for SecretCarousel, newest first, with their current status. Optionally filter by type.
sc_feedback_comments
Read the comment thread on a piece of feedback you filed (the SecretCarousel team may have replied with questions or a status update).
sc_comment_feedback
Add a follow-up comment to feedback you filed — attach extra repro detail, logs, or confirm whether a fix worked.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"secretcarousel": {
"secretcarousel": {
"command": "npx",
"args": [
"secretcarousel",
"mcp-serve"
],
"env": {
"SC_API_KEY": "sc_your_api_key_here"
}
}
}
}
}McpServers
{
"secretcarousel": {
"command": "npx",
"args": [
"secretcarousel",
"mcp-serve"
],
"env": {
"SC_API_KEY": "sc_your_api_key_here"
}
}
}The agent-first secret vault. Coding agents store, rotate, and share secrets — AES-256-GCM encrypted, audited, autonomous.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
